Description
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| ATP series firmware | Zyxel / ATP series firmware | 4.60 through 5.35 | affected |
| USG FLEX series firmware | Zyxel / USG FLEX series firmware | 4.60 through 5.35 | affected |
| VPN series firmware | Zyxel / VPN series firmware | 4.60 through 5.35 | affected |
| ZyWALL/USG series firmware | Zyxel / ZyWALL/USG series firmware | 4.60 through 4.73 | affected |